Intel 64 and IA-32 Architectures Software Developers Manual Volume 3B, System Programming Guide Part 2

Vol. 3 21-17
VMX NON-ROOT OPERATION
— If the “CR8-store exiting” VM-execution control is 0 and the “use TPR
shadow” VM-execution control is 1, MOV from CR8 reads from the TPR
shadow. Specifically, it loads bits 3:0 of its destination operand with the value
of bits 7:4 of byte 80H of the virtual-APIC page (see Section 20.6.8). Bits
63:4 of the destination operand are cleared.
— If the “CR8-store exiting” VM-execution control is 1, MOV from CR8 causes a
VM exit (see Section 21.1.3); the “use TPR shadow” VM-execution control is
ignored in this case.
• MOV to CR0. An execution of MOV to CR0 that does not cause a VM exit (see
Section 21.1.3) leaves unmodified any bit in CR0 corresponding to a bit set in the
CR0 guest/host mask. It causes a general-protection exception if it attempts to
set any bit to a value not supported in VMX operation (see Section 19.8).
• MOV to CR3. If the “enable EPT” VM-execution control is 1 and an execution of
MOV to CR3 does not cause a VM exit (see Section 21.1.3), the value loaded into
CR3 is treated as a guest-physical address; see Section 24.2.1.
— If PAE paging is not being used, the instruction does not use the guest-
physical address to access memory and it does not cause it to be translated
through EPT.
1
— If PAE paging is being used, the instruction translates the guest-physical
address through EPT and uses the result to load the four (4) page-directory-
pointer-table entries (PDPTEs). The instruction does not use the guest-
physical addresses the PDPTEs to access memory and it does not cause them
to be translated through EPT.
• MOV to CR4. An execution of MOV to CR4 that does not cause a VM exit (see
Section 21.1.3) leaves unmodified any bit in CR4 corresponding to a bit set in the
CR4 guest/host mask. Such an execution causes a general-protection exception
if it attempts to set any bit to a value not supported in VMX operation (see
Section 19.8).
• MOV to CR8. Behavior of the MOV to CR8 instruction (which can be executed
only in 64-bit mode) is determined by the settings of the “CR8-load exiting” and
“use TPR shadow” VM-execution controls:
— If both controls are 0, MOV to CR8 operates normally.
— If the “CR8-load exiting” VM-execution control is 0 and the “use TPR shadow”
VM-execution control is 1, MOV to CR8 writes to the TPR shadow. Specifically,
it stores bits 3:0 of its source operand into bits 7:4 of byte 80H of the virtual-
APIC page (see Section 20.6.8); bits 3:0 of that byte and bytes 129-131 of
that page are cleared. Such a store may cause a VM exit to occur after it
completes (see Section 21.1.3).
1. A logical processor uses PAE paging if CR0.PG = 1, CR4.PAE = 1 and IA32_EFER.LMA = 0. See
Section 3.8 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A.